Fix Amber login and relax team reads for members

[erskingardner]

Summary

• Added explicit signer-session handling for NIP-07, Amber/NIP-55, and bunker:// NIP-46 flows in the web app.
• Fixed Amber return handling so it can recover the signed result from clipboard or a manual paste prompt instead of dropping the user back into a dead end.
• Changed team detail access to allow team members to read their team while keeping mutations and secret-bearing routes admin-only.
• Updated the team page UI and docs to match the new auth model.

Testing

• cargo test --workspace
• cd web && bun test
• cd web && bun run check
• cd web && bun run build
• Local HTTP smoke check against the running dev server returned 200 OK with the expected security headers.